AWS Lambda S3 Access Without Internet Traversal

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

C Provision a gateway endpoint for Amazon S3 in the VPC and update the route tables of the subnets accordingly.

Question

A company runs an AWS Lambda function in private subnets in a VPC. The subnets have a default route to the internet through an Amazon EC2 NAT instance. The Lambda function processes input data and saves its output as an object to Amazon S3. Intermittently, the Lambda function times out while trying to upload the object because of saturated traffic on the NAT instance's network. The company wants to access Amazon S3 without traversing the internet. Which solution will meet these requirements?
  1. Replace the EC2 NAT instance with an AWS managed NAT gateway.
  2. Increase the size of the EC2 NAT instance in the VPC to a network optimized instance type.
  3. Provision a gateway endpoint for Amazon S3 in the VPUpdate the route tables of the subnets accordingly. Correct Answer
  4. Provision a transit gateway. Place transit gateway attachments in the private subnets where the Lambda function is running.

Key Takeaways

The exam tests knowledge of VPC endpoints by highlighting the constraint 'without traversing the internet', which eliminates NAT-based solutions (both instance and gateway) as valid options for this specific goal.

This question addresses how to enable AWS Lambda functions in private subnets to access Amazon S3 privately, avoiding internet traversal and NAT bottlenecks. It establishes that VPC Gateway Endpoints are the correct mechanism for this specific connectivity requirement.

Common mistake: Many candidates choose Option A (NAT Gateway) because it is the standard solution for private subnet internet access; however, they miss the critical instruction to avoid internet traversal entirely.

Expert Analysis

Why the Answer Is Correct

Option C is correct because a VPC Gateway Endpoint for Amazon S3 provides a private connection between your VPC and S3. When you provision a gateway endpoint and update route tables, traffic destined for S3 is routed via the AWS internal backbone rather than the public internet. This directly satisfies the requirement to access S3 without traversing the internet and resolves the NAT saturation issue since no traffic hits the NAT device.

Why the Other Options Are Wrong

Options A and B involve NAT technologies. While a NAT Gateway (A) offers higher scalability than an EC2 NAT instance, both still traverse the internet boundary (or at least the NAT perimeter) to reach S3 if S3 is not accessed via a PrivateLink/Gateway endpoint. The question explicitly forbids internet traversal. Option D (Transit Gateway) is designed for connecting multiple VPCs or on-premises networks, not for optimizing direct VPC-to-S3 traffic within a single VPC.

Community Comment Notes

Community consensus strongly supports C based on the keyword 'Without traversing the internet'. As Scheldon noted, NAT options are invalid because they still involve internet-bound traffic patterns relative to the VPC boundary logic. AlvinC2024 correctly identified that this keeps traffic within the AWS network. Some users like dds69 mistakenly chose A, focusing only on the 'saturated' aspect while ignoring the 'no internet' constraint.

Official Reference

https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always read the negative constraints carefully. If a question asks to avoid 'internet traversal' or 'public IP', immediately eliminate NAT Gateways and EC2 NAT instances. Look for VPC Gateway Endpoints (for S3/DynamoDB) or Interface Endpoints (for other services).

Frequently Asked Questions

Why isn't a NAT Gateway sufficient here?

A NAT Gateway still sends traffic out to the public internet (or through the NAT appliance's public interface). The question explicitly requires avoiding internet traversal.

Can I use a Transit Gateway for S3 access?

No, Transit Gateway is for inter-VPC or hybrid cloud connectivity. For direct S3 access from a VPC, a Gateway Endpoint is the dedicated and optimized solution.

More SAA-C03 FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. Scheldon 👍 4 Answered C
    Answer C "The company wants to access Amazon S3 without traversing the internet." so we cannot use any NAT like in answer A & B. Transit Gateways is allowing reach Direct Connect or VPN connection from VPC. Hence C need to be a good answer
  2. waldirlsantos 👍 4 Answered C
    The Key words are "Without traversig the internet". So, the awser is C. https://docs.aws.amazon.com/pt_br/vpc/latest/privatelink/gateway-endpoints.html
  3. AlvinC2024 👍 3 Answered C
    By provisioning a gateway endpoint for Amazon S3 in the VPC, you enable the Lambda function running in the private subnets to access S3 directly without needing to go through the NAT instance or traverse the internet. This solution helps alleviate the network congestion issue and reduces latency since the traffic between Lambda and S3 stays within the AWS network. Additionally, updating the route tables of the subnets to route S3 traffic through the gateway endpoint ensures that the Lambda function can seamlessly communicate with S3 without encountering timeouts caused by network saturation on the NAT instance.
  4. mk168898 👍 3
    without internet => gateway endpoints
  5. hpmargathia 👍 1
    A https://aws.amazon.com/about-aws/whats-new/2015/12/introducing-amazon-vpc-nat-gateway-a-managed-nat-service/
Show 2 more comments
  1. dds69 👍 1 Answered A
    NAT gateways are highly available and can automatically scale up to meet increased traffic demands.
  2. boubie44 👍 2
    why not D? i don't understand

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide